cf5755f958d23e1fed3368d902abf7a4eb83206c1ac9bd4d161f64e868ff1dc8

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 11.8MB
Sample260827-xt8zaacr21
SHA256 cf5755f958d23e1fed3368d902abf7a4eb83206c1ac9bd4d161f64e868ff1dc8
MD5 3f426d41105282aad75a13f29d63a230
SHA1 74d4cf984d05386c8f4b4fb0af5de84b294eb57a
SHA512 2a8febdbde69bb381bdec04a84281ea56ef02679140303008163159f011ab8a5e4a8c170221b5adbac49e79593e2d28f236e40f34e9d4b0a87918dd096a6905a
SSDEEP 98304:H5g5g5g5g5g5g5g5g5OKjKWQckVgtev5mnlNLv:H5g5g5g5g5g5g5g5g5zKWQc0gEYnvLv
TLSH
T1F5C64B19B7ED1890E5B3B17489A6C2B5DEB2B8604731C7DF9244D63D1E33AD0AC38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
2216	svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe
676	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACCCBBBBBBBAAABCCCCCBABCACBCBCCBCBAAABCBAABACCCCBACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe"	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCAAACBCBCBAABAACAAABCAACBCBAABAACABCBAACCCCCBCACCCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe"	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4136	sc.exe
4092	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2128	cmd.exe
4756	cmd.exe
4000	cmd.exe
4148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4720	schtasks.exe
1184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
676	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
676	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
2216	svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe
2216	svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
Token: SeDebugPrivilege	676	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
Token: SeDebugPrivilege	2216	svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2128	1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 2128 wrote to memory of 4720	2128	cmd.exe	101
PID 1340 wrote to memory of 4916	1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe	102
PID 4916 wrote to memory of 900	4916	notepad.exe	103
PID 1588 wrote to memory of 4756	1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	107
PID 4756 wrote to memory of 4136	4756	cmd.exe	109
PID 1588 wrote to memory of 4000	1588	2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	110
PID 4000 wrote to memory of 4092	4000	cmd.exe	112
PID 1340 wrote to memory of 4148	1340	svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe	115
PID 4148 wrote to memory of 1184	4148	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_3f426d41105282aad75a13f29d63a230_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCCABBCACCBAABABCBAACACBBBBCAABBBABCCBCABBABACBCBCBCCCABAABAAABAAACCABAACCBAAACBBCCCBBCCCABBAABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCCABBCACCBAABABCBAACACBBBBCAABBBABCCBCABBABACBCBCBCCCABAABAAABAAACCABAACCBAAACBBCCCBBCCCABBAABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABCAACBABBACCBBAACBCBCBCCAABCBAABAABACCCABBBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe" start= auto displayName= "UserDataSvc_CAAABCAACBABBACCBBAACBCBCBCCAABCBAABAABACCCABBBBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABCAACBABBACCBBAACBCBCBCCAABCBAABAABACCCABBBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe" start= auto displayName= "UserDataSvc_CAAABCAACBABBACCBBAACBCBCBCCAABCBAABAABACCCABBBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABCAACBABBACCBBAACBCBCBCCAABCBAABAABACCCABBBBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABCAACBABBACCBBAACBCBCBCCAABCBAABAABACCCABBBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABACABABCCCBBCCABBABABCCABCBACBACBCABCCBACBCBAABBACBCACAACBACAAABACBACCCACAABACCBAACBCCAABBCBAAACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABACABABCCCBBCCABBABABCCABCBACBACBCABCCBACBCBAABBACBCACAACBACAAABACBACCCACAABACCBAACBCCAABBCBAAACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBBBCABBCACCBBABAACCACAAACBABABBBCBBCCABCACCACBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1e6b79c3764e185161a6d474f2ff2a8cc174e8c09c63a3556335420db5f19c4e
MD5 f1539e13301b4832e2091a357adb8ba0
SHA1 b198774504fb07bb45111bdfaa0f81020bdec908
SHA512 dceac7b96d17b85a7210ef9aef23ccf16890bedf41247900fc048e6af446611db4cc69f50fcea50b01433cfbda977b13ea0c0b7f24a90ed884d7a276e345bf8d
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 12.3MB
SHA256 0f0be826022e8905d88ec9b8473016d69ff86043c3e958784ada97021f2984cf
MD5 bb6697512ec65f705ae85c7142180e9f
SHA1 78c18364b22301605e4eb7fad26cd5264f69464d
SHA512 8740e6d8a94f284a131e627759b63b7243c114864879dddf23cf14c922a184a04efcb2a928ee8d1ca24d758f967ed01836f1a48b5bc18b0453b99cae1bf964f6
SSDEEP 98304:H5g5g5g5g5g5g5g5g5OKjKWQckVgtev5mnlNL0piI:H5g5g5g5g5g5g5g5g5zKWQc0gEYnvLq
TLSH
T188D64B19B7ED1490E5B3A17489B6C2B5DEB2B8604731C7DFA244D63D1E33AD0AC38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\SoftLanding\qap`g`v~dtlq
Size 10B
SHA256 a98b942f7df219183ef37a98830843e6c20cf180e7abd2ba46880e8e7a55a945
MD5 6a1c4d780f8ba58b112b3707d6c7f7b7
SHA1 c1c4235f373efdcd3fe39f7f270826857dd4ac21
SHA512 5e7cf99f751531ca380dce0ec5a35e38924b4bd423320d34f44757fe23683e5c1aaf94cfaeb06360132ab9beeb7f357cf41d3a877218e2d4941ce38dc71b35e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 b5962ced7142c31bfbd2e4a8d6d772657706ebfe8a154ad2f14f62bd7ca73005
MD5 53817aabe6ac6fe785201d9230b4e701
SHA1 4a36e8f1078171c4df93447a7a0a11d13633f6a9
SHA512 8e498b5ccec083f3a9829d2c2778df47bf234f4320bb1c123f00e2a8c24cec1683257a5a34c7adf68078f74a92162a8d854ef932fe0e683395a744ba087c5edc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\az\qap`g`v~dtlq
Size 10B
SHA256 2a8056cabd52a157fce5262a8290b793ef10e0dd6df56f6990c61129d0879d8f
MD5 ab03a420693dfbce70064c37c685a203
SHA1 0362ceb718162e33239202f3cc0247d2699cfeb6
SHA512 09d8f02d64b06095c5bb2dcd2b5de05ad6de9873f587e8667437c5ea59a0dd6ec03189cc624f019fdbf33184127ce1468607840b61bf9ab90652ccfab4b7ab56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\uk\qap`g`v~dtlq
Size 10B
SHA256 ef8d88b55e5ea77aaa6386ed9ea22245ac16e52ceae0a4db31dd5408eb4cd401
MD5 00f03fbba78bf5b2005bd8c3939f6154
SHA1 cece477675bacbbde54e2f534d6e17e1aaef7a63
SHA512 d540ecd4ec3a121a27df6effe82a468e6a726618c839da56c133c5fbe23ec8dc9bfa1fad8277e4e4e6d36ff24f84314034902a8a2d48ee6223446db1bb7ff26b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 6b55bc537fa9a19427c5cc39c7a6f826edf714ba29f413b7c885a12ffdfba6f6
MD5 e5424576417c14de4ab0356a36132e8c
SHA1 115c67be124c4d212d61d67b8e027ee2ce97c3f9
SHA512 02cc545d30dc0b995880da79bf6049ef824aac790d4ff2377ed89c51df55012d2bcf21518a2e40e4b634f6f3eb23258d71a5fc0ed105eef5b0c5a86b18b6de34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72651c6293e457fec487b7bd4cc6c055bba40de05c0f26822e19ada46b163a84
MD5 604c4273fe1a9d8280c24bd3c732c75d
SHA1 61c5ddcb61a6f1e4e9d06e181f89ce133c950bc8
SHA512 475b3326c3355f9e6821f28c7cef6e467e9d6331712ddbf34bfbceeb42ed8a831199cf7677f24b73eaabd589239d4e19def6bef1255ed9e7be88d2540d4c0f0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69a3a0b572d08452a408e8830794752ddefb5ca2b9d6a6bfb6cc240d21b32fa6
MD5 bdd791da5e6ea3585c4cf46c0ba674d0
SHA1 d36970cd5528f086470b0c82426b241e12e3ea76
SHA512 ea68ddd090dfafbd18ce897283bf261ea7a90ced8585213bb4a426c45f0bd7581189c0030a86a0f6343cae56e69866a140f08b430e00248d11c9370884c58286
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 40069636952edbff22bb959e1407032a81cd1866e2348b4339ddcf796cfd926e
MD5 29b0a0583749048b42bd0aecd909343b
SHA1 39b745778e2f85d19c593b940992ee0951395900
SHA512 5aeb170db942f9b95f6a4cc2f590ce962865b5a397e840453818d6971c6641c314e2345d67ad21ca3c52256ed4c1d2c323129d70fb830cbd325768127a126899
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ada3f1a71ab48c811809466ba400b1700c8cae0da6a8059daa986cddf31971be
MD5 3adf016d43535764f1bc35aa46a70f99
SHA1 4231a43da8bb7bf486932258bcbbce139ed54108
SHA512 af1745abff84282085b0c1747e54432e213dfb87e1c59898932f7b1f14cac76faf8f7677f7b96b82315635aba72fe97759fc59746bb11f9a8cfe85e759a27037
MD5 SHA1 SHA512

Submit Download

svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCBCBCBCABCBAABBBCABABBBCBBBABBCABCBBCBCCCACACCBAB.exe
Size 11.8MB
SHA256 cf5755f958d23e1fed3368d902abf7a4eb83206c1ac9bd4d161f64e868ff1dc8
MD5 3f426d41105282aad75a13f29d63a230
SHA1 74d4cf984d05386c8f4b4fb0af5de84b294eb57a
SHA512 2a8febdbde69bb381bdec04a84281ea56ef02679140303008163159f011ab8a5e4a8c170221b5adbac49e79593e2d28f236e40f34e9d4b0a87918dd096a6905a
SSDEEP 98304:H5g5g5g5g5g5g5g5g5OKjKWQckVgtev5mnlNLv:H5g5g5g5g5g5g5g5g5zKWQc0gEYnvLv
TLSH
T1F5C64B19B7ED1890E5B3B17489A6C2B5DEB2B8604731C7DF9244D63D1E33AD0AC38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6234f91d8b8d23d0549d70592919498f0568ec72ef7ba4d01cf82575559784e4
MD5 89bfd085c4034829f8599cd49452f9df
SHA1 7c46764d26e6662e6280ea733b05d1640ea502ab
SHA512 65d54de7d469b0411e172828c6d89d6850ef3bc8d57afce01b0f1d90f1bcab35ff4683dd2b7c950fd21c341510fb7aec6b4c575f8ed2c9ce5fe76483aa80d163
TLSH
T18C116A50F0F4EC53E5B2A8CB47159ED6199833DFACDC5A14234E8348ABDAC31CE994E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9c94ae349f16b64e4e091bcf39fe6f8c4e972bb2216eb05ca41bc77c749cad95
MD5 2a1473bcec048aa2461380921b61f96d
SHA1 31366a59b2d494d86edc53067750e2fb6eb59ee3
SHA512 78458477c3b5b01045c57d70e09037dd3afe40c3057f503f5023dc747453eb872462668aff648ad78c487e00c057f777891ca7f4c6c5a34e841b1f78b9c9bf05
TLSH
T179212990F0F4EC53E572A8CB97159AD619A833DF9CDC5A14234E82486BDAC31CE994E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 f43b36f93f1eca03aee7ce0399524cc30445a11198e699094e6e5f486b927d0d
MD5 9d46e87db226529ccbd7a32f43236d6a
SHA1 1ff18e49ac18dbfb32ec39fd1c978860294692a4
SHA512 b930a9ebe2ec509802ffd749c9f33b9561dd44abb2755074c161374e49969198cbb98af8c7884cfd33e99fdccafffab383b4e6030f82e9b79cf344190810c713
TLSH
T154113A40A0F5EC57E4B2A8CB47158DD71DED37CFACD86A24234D42486BCAC318F9A0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/676-1382-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/1340-36-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/1588-6-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/2216-71-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/2216-2746-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/4916-59-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download